OpenClaw: Workspace dotenv could override runtime-control environment variables

高 7.8CVE-2026-44114 · GHSA-hxvm-xjvf-93f3 · 06/05/2026 公開 · 17/06/2026 更新

要点

CVE-2026-44114 は openclaw (openclaw), openclaw に影響する深刻度「高」 (CVSS 7.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.13%（全脆弱性の 2.5% より高い）。
対処：2026.4.20 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
openclaw openclaw	`< 2026.4.20`	`2026.4.20`
openclaw npm	`< 2026.4.20`	`2026.4.20`

概要

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: < 2026.4.20
Patched version: 2026.4.20

Impact

Workspace .env loading did not reserve the OPENCLAW_ runtime-control namespace broadly enough. A malicious workspace could set variables such as OPENCLAW_GIT_DIR before source-update or installer flows, potentially steering trusted OpenClaw runtime behavior.

This requires running OpenClaw from an attacker-controlled workspace. Severity is medium.

Fix

OpenClaw now reserves the workspace OPENCLAW_ environment namespace and rejects workspace dotenv entries for OpenClaw runtime-control variables.

Fix commit:

018494fa3ebb9145112e68b56fe1cb2e9f9a9ed6

Release

Fixed in OpenClaw 2026.4.20.

NVD の説明

OpenClaw before 2026.4.20 fails to properly reserve the OPENCLAW_ runtime-control environment namespace in workspace dotenv files, allowing attackers to override critical runtime variables. Malicious workspaces can set variables like OPENCLAW_GIT_DIR to manipulate trusted OpenClaw runtime behavior during source-update or installer flows.